Privacy Policy

Last updated: June 2026

1. Who We Are

Car Audit ("we", "us", "our") provides independent pre-purchase vehicle inspection services. We are the data controller of the personal data described in this policy, which explains what we collect, why we collect it, how long we keep it, who we share it with, and the rights you have over it. We are committed to handling personal data in accordance with UK data protection law, including the UK GDPR and the Data Protection Act 2018.

Car Audit.

2. What Data We Collect

We collect personal information when you:

Book an inspection through our website, by phone, or by WhatsApp
Contact us via our contact form, by email, by phone, or by WhatsApp
Sign up to receive communications from us
Leave a review or provide feedback on our service

The data we collect may include:

Your name, email address, phone number, and any postal address you provide
The vehicle details you provide (make, model, registration, and the address at which the vehicle is kept)
Details of the seller that you provide so we can arrange access, such as their name, phone number, and address
Your communication history with us, including messages sent by email, contact form, or WhatsApp
Payment information, which is processed securely by our payment provider; we do not receive or store your card details
Technical data generated when you use our website, such as IP address, browser type, and pages visited, collected through cookies and similar technologies (see section 9)

Vehicle history data. When you provide a vehicle registration, we retrieve information about that vehicle from public and third-party sources, including MOT history, recorded mileage, write-off markers, and outstanding finance checks. This is data about the vehicle rather than about you, but it may be linked to your booking record.

Photographs. During an inspection we photograph the vehicle to evidence our findings. We take reasonable care to avoid capturing identifiable people or unrelated private property, and any incidental capture is not used for any purpose beyond the report.

3. Seller Information

Where you give us a seller's contact details so that we can arrange the inspection, we use those details solely to contact the seller about access to the vehicle, to attend the inspection, and to maintain a record of the job. We do not use seller details for marketing, and we do not share them with anyone except as described in section 6. By providing a seller's details, you confirm that you are entitled to pass them to us for this purpose. Sellers may contact us via our Contact page with any query about how their details have been used.

4. How We Use Your Data

We use personal information to:

Provide and manage the inspection service you have booked, including arranging access with the seller
Retrieve the vehicle history relevant to your booking
Prepare and deliver your written report
Contact you about your booking, report, or enquiry
Process your payment securely through our payment provider
Respond to enquiries, requests, and complaints
Keep business and accounting records we are legally required to hold
Send you service-related communications, such as booking confirmations and report delivery

We will only send you marketing communications if you have given explicit consent, and you can withdraw that consent at any time by contacting us or using the unsubscribe option in any marketing message. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

5. Legal Basis for Processing

We process personal data on the following legal bases under UK GDPR:

Contract: to take the steps you ask of us before booking and to fulfil the inspection service you have booked
Legal obligation: to keep accounting, tax, and business records required by law
Legitimate interests: to manage our business effectively, maintain records of jobs and correspondence, arrange inspections with sellers, and defend or exercise legal claims; where we rely on legitimate interests we balance them against your rights and interests
Consent: for any marketing communications you have opted into, and for any non-essential cookies

6. Data Sharing

We do not sell personal data, and we do not share it with third parties for their marketing purposes. We share data only with:

Our e-commerce and website platform (Shopify), which hosts our website and processes bookings placed through it
Our payment processor, to complete your transaction securely
Our booking and scheduling software provider, to manage appointment times
Vehicle data providers, to whom we submit the registration number in order to retrieve MOT, mileage, write-off, and finance information
Communication providers we use to contact you, such as our email service and WhatsApp (provided by Meta), where you choose to communicate with us on that channel
Professional advisers, such as accountants, insurers, or legal advisers, where reasonably necessary
Legal or regulatory authorities, where we are required to do so by law

Each provider we use processes data under contractual terms requiring it to be handled in accordance with UK data protection law, and only for the purpose for which it was shared.

7. International Transfers

Some of the providers listed above, including our website platform and messaging services, store or process data on servers outside the United Kingdom. Where personal data is transferred outside the UK, the transfer is protected by safeguards recognised under UK data protection law, such as UK adequacy regulations or the appropriate standard contractual clauses, together with the providers' own security measures.

8. Data Retention

We keep personal data only for as long as it is needed for the purposes described in this policy and to meet our legal obligations. As a guide:

Booking, inspection, and report records: up to 6 years from the date of the inspection, for accounting, legal, and insurance purposes
Correspondence and enquiries that do not lead to a booking: up to 2 years
Marketing consents and preferences: until you withdraw consent, plus a suppression record so we do not contact you again

When data is no longer required, it is securely deleted or anonymised.

9. Cookies

Our website uses cookies and similar technologies. Essential cookies are required for the site and checkout to function, including those set by our platform provider, and do not require consent. If analytical or marketing cookies are enabled, they should be used only with your consent through the cookie controls presented on our site. If no controls are shown, this theme should be treated as using only strictly necessary cookies and the third-party services you actively choose to open. You can also manage or delete cookies through your browser settings, although blocking essential cookies may stop parts of the site, such as booking and checkout, from working.

10. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss, and disclosure, including access controls, encrypted connections, and reputable hosting and payment infrastructure. Payment card information is handled entirely by our payment processor and never touches our systems. No method of transmission or storage is completely secure, but we review our arrangements regularly and will notify you and the ICO of any breach where the law requires it.

11. Your Rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Request correction of inaccurate or incomplete data
Request deletion of your data, where we have no overriding legal obligation or legitimate ground to retain it
Object to processing based on legitimate interests, and to any processing for direct marketing, which we will stop without exception
Request restriction of processing in certain circumstances
Data portability: to receive the data you provided to us in a structured, commonly used, machine-readable format
Withdraw any consent you have given, at any time

To exercise any of these rights, contact us via our Contact page. We will respond within one calendar month, and there is normally no charge. We may need to verify your identity before acting on a request. You will never be penalised for exercising a data protection right, and we do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

12. Children

Our services are directed at adults purchasing vehicles, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Complaints

If you have a concern about how we handle personal data, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113. We would ask that you contact us first so we can try to resolve the matter directly, but you are free to approach the ICO at any time.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, our providers, or the law. Significant changes will be communicated on this page, and the date at the top of the page shows the most recent revision. The version in force at the time you use our services applies to that use.

15. Contact Us

For any privacy-related questions or requests, including requests to exercise your rights, please contact us via our Contact page.